A flaw was found in Ansible Engine's ansible-connection module where sensitive information such as the Ansible user credentials is disclosed by default in the traceback error message. The highest threat from this vulnerability is to confidentiality.

🗓️ 16 Mar 2022 07:00:00Reported by MicrosoftType

Flaw in Ansible Engine ansible-connection module discloses credentials in tracebacks, risking confidentiality.

Reporter	Title	Published	Views	Family All 84
FreeBSD	Ansible -- Ansible user credentials disclosure in ansible-connection module	25 Jun 202100:00	–	freebsd
AstraLinux	Astra Linux – Vulnerability in Ansible	20 May 202605:53	–	astralinux
BDU FSTEC	The vulnerability of the ansible-connection module in the Ansible Configuration Management system, related to the disclosure of information in error messages, allows a perpetrator to gain access to confidential data.	13 Sep 202400:00	–	bdu_fstec
CBLMariner	CVE-2021-3620 affecting package ansible 2.9.23-2	26 May 202219:04	–	cbl_mariner
Tenable Nessus	CentOS 9 : ansible-core-2.14.2-4.el9	29 Feb 202400:00	–	nessus
Tenable Nessus	FreeBSD : Ansible -- Ansible user credentials disclosure in ansible-connection module (9a8514f3-2ab8-11ec-b3a1-8c164582fbac)	13 Oct 202100:00	–	nessus
Tenable Nessus	RHEL 7 / 8 : Ansible security update (2.9.27) (Important) (RHSA-2021:3871)	15 Oct 202100:00	–	nessus
Tenable Nessus	RHEL 7 / 8 : Ansible security update (2.9.27) (Important) (RHSA-2021:3872)	15 Oct 202100:00	–	nessus
Tenable Nessus	RHEL 8 : Red Hat Ansible Automation Platform 2.0.1 Security and Bug fix Release (Important) (RHSA-2021:3874)	28 Apr 202400:00	–	nessus
Tenable Nessus	RHEL 8 : RHV Engine and Host Common Packages security update [ovirt-4.4.9] (Important) (RHSA-2021:4703)	18 Nov 202100:00	–	nessus